PT-2025-33094 · Unknown · Dolibarr Erp/Crm

Published 2025-08-13 · Updated 2025-08-15 · CVE-2012-10059

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM versions prior to 3.1.1 Dolibarr ERP/CRM versions prior to 3.2.0

Description: Dolibarr ERP/CRM contains a post-authenticated operating system command injection issue in its database backup feature. The export.php script does not sanitize the sql compat parameter, allowing authenticated users to inject arbitrary system commands, leading to remote code execution on the server.

Recommendations: Update Dolibarr ERP/CRM to a version prior to 3.1.1. Update Dolibarr ERP/CRM to a version prior to 3.2.0.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2012-10059

Affected Products

Dolibarr Erp/Crm

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2012-10059 · Security Note
• https://cve.org/CVERecord?id=CVE-2012-10059 · Security Note
• https://ubuntu.com/security/CVE-2012-10059 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-10059 · Vendor Advisory
• https://seclists.org/fulldisclosure/2012/Apr/78 · Note
• https://vulncheck.com/advisories/dolibarr-erp-crm-post-auth-os-command-injection · Note
• https://exploit-db.com/exploits/18724 · Note
• https://t.me/CVEtracker/29941 · Telegram Post
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dolibarr_cmd_exec.rb · Note
• https://dolibarr.org · Note
• https://exploit-db.com/exploits/18725 · Note